# Automatically Rotating GitHub Tokens (So You Don't Have To)

DevFeed: [Automatically Rotating GitHub Tokens (So You Don't Have To)](<https://devfeed.tech/articles/automatically-rotating-github-tokens-so-you-don-t-have-to-1299.md>)

Original publisher: [Read original article](<https://shopify.engineering/automatically-rotate-github-tokens>)

Author: Evan Lee

Published: 2022-12-20T15:00:01Z

Content type: article

Language: en

Sources: [Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering.md>), [Shopify Engineering - Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering-shopify-engineering.md>)

Topics: [GitHub](<https://devfeed.tech/topics/github.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [pull-requests](<https://devfeed.tech/tags/pull-requests.md>), [security](<https://devfeed.tech/tags/security.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

## AI overview

This article explains how Shopify addressed limitations in GitHub's built-in token authentication and personal access tokens by building a system that automatically rotates GitHub access tokens. It discusses workflow use cases requiring access to external private repositories, organization-level projects, and downstream workflow triggers, as well as the operational and security risks of long-lived personal access tokens.

## Source excerpt

We encountered a problem that lives in the gap between two tried-and-true GitHub authentication methods: personal access tokens and built-in authentication. Our solution? Build a system to automatically rotate GitHub access tokens. Here's how we did it and how you can do it too.